{
  "family": "blackhole",
  "sample_count": 14,
  "category": "exploit_kit",
  "description": "Blackhole (historically documented as Exploit:Win32/Blackhole and the Blackhole Exploit Kit / BHEK) was the single most dominant commercial exploit kit in the cybersecurity landscape between 2010 and 2013, operated by the cybercriminal author known as 'Paunch'. Hosted on thousands of compromised web servers and promoted via malicious spam and malvertising, Blackhole fingerprinted visiting web browsers and dynamically loaded weaponized browser exploits targeting vulnerabilities in Oracle Java (e.g., CVE-2012-0507, CVE-2012-1723), Adobe Flash Player, Adobe Reader, and Internet Explorer. Once an exploit achieved memory corruption and code execution, Blackhole executed shellcode to silently download and install secondary banking trojans (such as Zeus, Citadel) and ransomware (such as Reveton).",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Exploit:Win32/Blackhole",
    "Blackhole Exploit Kit",
    "BHEK",
    "TrojanDownloader:Win32/Blackhole",
    "Exploit.Blackhole"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Exploit:Win32/Blackhole (Blackhole Exploit Kit)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Blackhole was a historic web exploit kit that automated drive-by downloads by targeting browser, Java, and Flash vulnerabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How did Blackhole compromise visiting web users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It evaluated client User-Agent and plugin versions, serving matched exploits against unpatched browser plugins silently."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware was distributed by Blackhole?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly dropped Zeus banking trojans, Citadel financial malware, and Reveton police ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How was Blackhole distributed across the web?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through mass spam campaigns with malicious links, compromised website iframes, and malicious advertising networks."
      }
    },
    {
      "@type": "Question",
      "name": "How was the Blackhole Exploit Kit dismantled?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Russian law enforcement arrested its primary author 'Paunch' in October 2013, collapsing its infrastructure and development."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1203",
    "T1059.007",
    "T1105",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (Browser/Plugin Exploitation)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery (Environment Profiling)",
      "tactic": "Discovery"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (JavaScript Obfuscation)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Payload Delivery)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint; a successful Exploit Kit trigger means a secondary, highly severe payload (like a banking trojan or ransomware) has already executed.",
    "Analyze web proxy and DNS logs to trace the redirect chain back to the initially compromised website or malvertising domain, and block those domains enterprise-wide.",
    "Capture a forensic image of the endpoint to analyze the specific exploit used and the dropped payload.",
    "Aggressively patch all web browsers, Java, Adobe Reader, and Flash Player across the enterprise, as Exploit Kits rely entirely on unpatched software."
  ],
  "what_to_avoid": [
    "Do not assume the user intentionally downloaded malware; Exploit Kit infections are 'drive-by' and require zero user interaction beyond loading a webpage.",
    "Avoid focusing solely on the downloaded `.exe` payload; you must investigate the network logs to understand *how* the Exploit Kit gained execution via the browser."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Exploit:Win32/Blackhole",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:Win32/Blackhole"
    },
    {
      "name": "Sophos Threat Center - Blackhole Exploit Kit Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~BHEK"
    },
    {
      "name": "MITRE ATT&CK - Drive-by Compromise (T1189)",
      "url": "https://attack.mitre.org/techniques/T1189/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}